SSRF protection bypass via IPv4-mapped IPv6 literals (CVE-2026-2455)

func (a *App) getLinkMetadataForURL(rctx request.CTX, requestURL string) (*opengraph.OpenGraph, *model.PostImage, error) {
    // ...
    client := a.HTTPService().MakeClient(false)

allowIP := func(ip net.IP) error {
    reservedIP := IsReservedIP(ip)

    ownIP, err := IsOwnIP(ip)
    if err != nil {
        return fmt.Errorf("unable to determine if IP is own IP: %w", err)
    }

    if !reservedIP && !ownIP {
        return nil
    }

    if reservedIP {
        return fmt.Errorf("IP %s is in a reserved range and not in AllowedUntrustedInternalConnections", ip)
    }
    return fmt.Errorf("IP %s is a self-assigned IP and not in AllowedUntrustedInternalConnections", ip)
}

ips, err := net.LookupIP(host)
if err != nil {
    return nil, err
}

for _, ip := range ips {
    if err := allowIP(ip); err != nil {
        forbiddenReasons = append(forbiddenReasons, err.Error())
        continue
    }

    conn, err := dial(ctx, network, net.JoinHostPort(ip.String(), port))
    if err == nil {
        return conn, nil
    }
}

func IsReservedIP(ip net.IP) bool {
    if ip4 := ip.To4(); ip4 != nil {
        ip = ip4
    }
    for _, ipRange := range reservedIPRanges {
        if ipRange.Contains(ip) {
            return true
        }
    }
    return false
}